Browser Storage Architecture
18 min read
LocalStorageSessionStorageCookiesIndexedDBCache API
Browser Storage Options
| Storage | Size Limit | Persistence | Sent to Server? | Best For |
|---|---|---|---|---|
| Cookies | 4KB | Configurable (expires/max-age) | Yes (every request) | Auth tokens, preferences |
| LocalStorage | 5-10MB | Permanent (until cleared) | No | User preferences, theme |
| SessionStorage | 5-10MB | Tab lifetime | No | Form state, wizard progress |
| IndexedDB | 50MB+ | Permanent | No | Offline data, large datasets |
| Cache API | Varies | Permanent | No | Service worker, offline assets |
Security Considerations
- Never store JWTs in LocalStorage — vulnerable to XSS
- Use httpOnly, Secure, SameSite cookies for auth
- IndexedDB is same-origin isolated